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depending  on  the  task  being  processed.  Colored  Petri  Nets  are  used  as  the  appropri¬ 
ate  mathematical  formalism  to  represent  variable  architectures  within  a  well-defined 
framework.  The  specifications  of  design  requirements  are  expressed  in  that  frame¬ 
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INTRODUCTION 

This  paper  illustrates  a  methodology  (Demael,  1989)  that  has  been  developed  to  model  and 
generate  variable  structure  distributed  architectures  for  systems.  A  hypothetical  design  of  a  sim¬ 
plified  C-'  system  that  formulates  tactical  responses  in  submarines  is  presented.  The  submarine  is 
supposed  to  be  in  a  sensitive  tactical  situation,  and  faces  two  major  external  threats,  torpedoes  and 
depth  charges.  The  goal  is  to  design  a  Command  and  Control  system  that  adapts  its  structure  of  in¬ 
teraction  to  the  tactical  parameters.  The  methodology  has  been  developed  to  meet  ever  increasing 
requirements  of  reliability  and  reconfigurability  from  users  by  studying  variable  structure  systems. 
In  these  systems,  the  interactions  between  components  can  change  depending  on  the  task,  while 
the  same  task  can  be  performed  with  different  combinations  of  resources.  As  some  patterns  of  in¬ 
teractions  may  be  more  suitable  for  the  processing  of  a  given  input  than  others,  a  properly  designed 
variable  structure  system  can  be  expected  to  achieve  a  higher  overall  performance,  provided  that  it 
adapts  its  structure  to  the  most  appropriate  interactions  for  each  type  of  input. 

In  an  operational  context  such  as  a  system,  teams  of  decision  makers  (Grevet  and  Levis, 
i9SS  )  are  organized  to  overcome  the  individual  cognitive  limits.  Through  specialization,  individu¬ 
als  acquire  the  capacity  to  apply  relatively  complex  cognitive  strategies  to  narrowly  defined  tasks 
environments.  Through  division  of  labor,  substantial  cognitive  resources  can  be  ‘  '^ultaneously 
.wrought  to  bear  on  many  tasks  or  information  sources  at  a  time.  The  most  important  difficulty  en¬ 
countered  with  the  design  of  those  systems  is  the  coordination  problem  (Crecine  and  Salomone, 
1988),  the  need  for  the  pattern  of  activities  carried  out  by  individuals  in  various  subunits  of  the 
SN  Stem  to  fit  together  in  a  coherent  fashion.  Demael  (1989)  describes  and  solves  the  coordi¬ 
nation  problem  for  a  well  defined  class  of  systems,  those  that  process  deterministically  a  set  of 
simultaneous  observations.  An  appropriate  mathematical  framework  has  been  defined,  which  is 
based  on  the  theory  of  Colored  Petri  Nets  (Jensen,  1987),  an  extension  of  the  Petri  Net  theory 
(Reisig,  1985).  In  this  approach,  the  tokens  have  an  identity  that  represents  the  information  content 
of  the  object  being  modeled.  The  variable  interactions  between  the  elements  in  the  system  are  de¬ 
scribed  using  the  language  of  Linear  Algebra. 

In  the  next  section,  the  elements  from  which  a  system  may  be  built  are  identified.  The  de¬ 
sign  requirements  of  a  system  for  a  submarine  are  presented  in  the  third  section.  The  con¬ 
straints  that  must  be  satisfied  by  a  solution  to  make  physical  sense  are  developed  in  the  fourth  sec¬ 
tion.  Finally,  the  fifth  section  outlines  the  search  for  solutions  and  interprets  the  results. 

MATHEMATICAL  MODEL 

A  system  has  a  variable  structiwe  if  the  interactions  between  the  objects  that  belong  to 
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the  system  can  vary.  Reciprocally,  a  system  for  which  the  interactions  between  objects  cannot  vary 
has  a  fixed  structure.  This  paper  is  restricted  to  the  systems  whose  variability  is  triggered  by  pa¬ 
rameters  that  are  external  to  the  system,  can  be  sensed  by  some  processes,  and  can  be  communi¬ 
cated  to  the  objects.  Furthermore,  the  emphasis  has  been  placed  on  describing  how  interactions  in 
the  system  are  influenced  by  the  external  inputs,  as  opposed  to  a  description  of  the  information 
content  of  the  interactions.  In  the  submarine  example,  the  focus  is  thus  on  studying  the  interactions 
that  are  triggered  within  the  Command  and  Control  system  by  tactical  parameters.  These  parame¬ 
ters  are  assessed  by  sensors  (active  and  passive  sonar),  which  detect  the  presence  of  vessels  on 
the  surface  or  in  the  deep  sea  environment.  The  influence  of  other  inputs  such  as  engine  failure  or 
emergency  have  not  been  incorporated;  they  have  been  treated  in  Weingaertner  (1989). 

The  methodology  addresses  the  coordination  problem  of  the  functional  entities,  the  roles.  A 
role  is  a  prescribed  pattern  of  behavior,  a  series  of  repetitive  but  uncertain  tasks,  imposed  by  the  re¬ 
quirements  of  the  mission.  Each  role  is  performed  by  a  human  being  or  by  an  intelligent  computer¬ 
ized  node.  Three  roles  have  been  identified  in  the  submarine  example:  The  Anti  Submarine  Warfare 
role  (ASW),  the  Anti  Surface  Warfare  role  (ASLTVVO,  and  the  Officer  of  the  Deck  (OOD).  The  OOD 
is  at  the  top  of  the  hierarchical  chain,  and  has  the  responsibility  for  integrating  all  aspects  of  the 
ship's  mission.  However,  OOD  does  not  have  immediate  access  to  the  sonar's  observations, 
which  are  the  responsibilities  of  ASW  and  ASUW.  The  area  of  competence  of  ASW  is  anti  subma¬ 
rine  warfare.  ‘  'V/  monitors  the  deep  sea  en’-ironment  through  different  acoustical  devices.  ASW 
has  been  trained  to  recognize  the  characteristic  noise  of  foes  and  friendly  ships,  as  well  as 
their  tactical  submarine  procedures.  Similarly,  ASUW  is  the  expert  in  anti-surface  warfare. 
■ASUW  can  recognize  the  noise  of  ships,  the  type  of  missions  to  which  ships  can  be  assigned,  and 
all  relevant  aspects  of  surface  warfare.  The  system  has  to  develop  a  tactical  response  that  is 
transmitted  to  the  effectors,  the  rest  of  the  crew,  which  includes  the  ship  control  party  and  the  com¬ 
bat  elements.  The  goal  of  the  methodology  is  to  create  a  Colored  Petri  Net  model  of  dataflow  from 
the  sources  to  the  roles,  the  exchange  of  information  between  roles,  and  the  communication  of 
messages  to  the  effectors.  A  Colored  Petri  Net  can  then  be  used  to  assess  the  effectiveness  of  a 
structure,  using  the  System  Effectiveness  Analysis  methodology  as  described  in  Monguillet 
(1988). 

The  C^  systems  that  are  being  modeled  are  rempora/Zy  L  .  istent  and  deterministic. 

1)  They  process  observations  that  refer  to  the  same  temporal  origin,  i.e.,  to  an  event  with  a  spe¬ 
cific  time  of  occurrence  (Grevet,  1988); 

2)  The  processing  of  one  set  of  simultaneous  observ’ations  is  achieved  while  involving  a  unique 

set  of  interactions. 

The  C^  system  of  a  submarine  monitors  indeed  "on  line"  the  state  of  the  environment,  so  as  to 
react  appropriately.  The  deterministic  assumption  indicates  that  the  activities  of  OOD,  ASW,  and 
ASUW  have  been  coordinated  so  as  to  produce  one  single  response,  that  of  the  system  OOD, 
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ASW,  and  ASUW  process  data  transmitted  by  sensors,  which  can  be  modeled  by  two  sources  of 
information.  Each  sensor  outputs  one  signal  or  symbol,  also  called  a  color,  from  its  associated  set 
of  possible  signals,  its  output  alphabet. 

•  Sensor  1  describes  the  deep  sea  environment.  Its  output  alphabet  is 

XI  =  {NoSubmarine,  Submarine,  Torpedo), 

NoSubmarine  indicates  that  no  submarine  is  detected  by  acoustical  devices.  Submarine  in¬ 
dicates  that  the  noise  of  a  submarine  vessel  has  been  heard,  Torpedo  indicates  the  detection  of 
a  torpedo.  To  make  the  notation  more  compact,  XI  is  abbreviated  by  XI  =  {NS,  S,  T}. 

•  Sensor  2  describes  the  surface  environment.  Its  output  alphabet  is 

X2  =  (NoSurface,  Surface,  Depth  Charge), 

NoSurface  indicates  that  no  particular  noise  coming  from  the  sea  surface  hints  at  the  presence 
of  a  surface  ship  or  a  plane,  Surface  indicates  that  some  characteristic  noise  has  been 
heard,  and  Depth  Charge  models  the  detection  of  an  offensive  weapon.  X2  is  abbreviated  as 
X2  =  (NSU,  SU,  dC). 

•  .As  the  observ'ations  are  temporally  consistent,  the  inputs  to  the  system  from  the  two  sen¬ 
sors  are  modeled  by  the  cross  product,  XI  x  X2,  of  the  output  alphabets.  X  ccr.tains  9  in¬ 
puts  lexicographically  ordered: 

X  =  {  <.NS,  dC>.  <NS,  NSU>,  <NS,  SU  >,  <S,  dC>,  <S,  NSU  >,  <S.  SU  >,  <T,  dC>,  <T,  NSU  >,  <T,  SU  >) . 

In  the  Colored  Petri  Net  model,  Sensor  i  is  modeled  by  a  place  annotated  by  Xi,  the  output  al¬ 
phabet.  A  transition  models  the  communication  of  its  output.  The  temporal  consistency  is  modeled 
by  the  fact  that  all  sensors  are  the  output  of  a  single  process.  Tnis  process  has  a  single  input  place 
pO,  which  is  called  the  external  place. 

Each  element  in  X  =  XI  x  X2  represents  a  combination  of  tactical  parameters.  The  determinis¬ 
tic  assumption  implies  that  there  is  one  and  only  one  fixed  structure  architecture  that  is  associated 
with  any  element  of  X,  i.e.,  that  to  each  combination  of  tactical  parameters  corresponds  one  and 
only  one  fixed  pattern  of  interactions  between  roles.  Of  course,  several  elements  in  X  might  corre¬ 
spond  to  the  same  fixed  global  pattern  of  interactions,  if  similar  tactical  parameters  require  the  same 
set  of  interactions  between  OOD,  ASW,  and  ASUW,  while  radically  different  tactical  situations 
might  correspond  to  very  different  fixed  patterns  of  interactions. 
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Sensor  1  _ 

Communication  process 

from  Sensor  1 


Communication  process 
from  Sensor  2 

Fig.  1  Sensors 

In  the  Colored  Petri  Net  model,  each  interaction  is  represented  by  a  link  between  two  transitions, 
as  depicted  in  Fig.  2.  The  arcs  of  the  link  are  annotated  by  a  9  x  9  diagonal  matrix  L. 

•  Lj;  =  1  if  the  i-th  input  in  the  lexicographic  ordering  of  X  activates  the  link. 

•  Lji  =  0  if  the  i-th  input  in  the  lexicographic  ordering  of  X  does  not  activate  the  link. 


Fig.  2  Link 

Consider  the  matrix  LI  for  example.  This  interaction  is  activated  if  and  only  if  the  input  to  the  sys¬ 
tem  is  <S,  NSU>  or  <T,  NSU>.  The  diagonal  elements  that  correspond  to  these  two  inputs  are 
unity. 

<NS.dC>  <NS,NSU>  <NS.SU>  <S.dC>  <S.  NSU  ><S,  SU  ><T.  dC>  <T.NSU><T.SU> 

Ll=diag[  0,  0,  0,  0,  1,  0,  0,  1,  0  ]. 

There  are  three  basic  types  of  interactions  in  a  variable  structure: 

•  The  inadmissible  links.  These  are  the  links  for  which  L  is  the  IXI  x  IXI  null  matrix.  No  input 
requires  this  interaction  to  be  processed.  These  links  are  not  depicted  on  a  Colored  Petri  Net 
model  of  the  C3  system. 

•  The  permanent  links.  These  are  the  links  for  which  L  is  the  IXI  x  IXI  identity  matrix. 
Every  input  requires  this  interaction  to  be  processed.  By  convention,  these  links  are  depict¬ 
ed  without  annotation  on  a  CPN  model. 

•  'Vnt  variable  links.  These  are  the  links  for  which  L  has  Os  and  Is  on  the  diagonal.  Some 
inputs  require  this  interaction  in  order  to  be  processed,  while  some  do  not. 

Inadmissible  links  and  permanent  links  are  of  little  interest  as  far  as  the  coordination  problem 
between  roles  is  concerned.  If  a  link  is  inadmissible  or  permanent,  the  existence  of  the  interaction 
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is  not  subordinated  to  the  information  content  of  the  input.  This  cannot  be  the  case  for  variable 
links.  In  those  cases,  the  decision  to  interact  or  not  is  based  on  the  information  content  of  the 
input,  and  must  be  simultaneously  recognized  by  the  roles  that  interact.  The  major  difficulty  is  that 
different  roles  might  not  have  access  to  the  same  sources  of  information,  and  cannot  be  meaning¬ 
fully  coordinated.  Two  notions  have  been  identified  to  deal  rigorously  with  the  coordination  of 
variable  interactions.  A  source  of  information  Sensor  i  (an  output  alphabet  Xi)  is  said  to  be  acces¬ 
sible  at  some  process  t  if  the  process  can  receive  information  generated  by  the  output  of  Sensor  i. 
A  source  of  information  Sensor  i  (an  alphabet  Xi)  is  said  to  be  effective,  if  the  decision  whether  or 
not  to  interact  is  based,  partially  or  in  whole,  on  the  output  of  Sensor  i. 

Each  role  in  a  fixed  structure  has  been  modeled  by  a  subnet  with  four  transitions  and  three  in¬ 
ternal  places,  presented  in  Fig.  ?  (Levis.  1984  and  1988).  The  four  stage  decision  making  process 
consists  of  four  algorithms  SA,  IF,  Cl,  and  RS.  In  Figure  3,  x  represents  an  input  signal  from  an 
e.xternal  source  of  information  or  from  the  rest  of  the  organization,  i.e.,  from  another  role.  The 
Situation  Assessment  (SA)  algorithm  processes  the  incoming  signal  to  obtain  an  assessment  of  the 
situation.  The  assessed  situation  z  may  be  transmitted  to  other  decision  making  processes. 
Concurrently,  the  role  may  incorporate  one  or  several  signals  z"  from  other  parts  of  the  system. 
The  signals  z  and  z"  are  fused  together  in  the  Information  Fusion  stage  (IF)  to  produce  the  final 
situation  assessment  z.  The  next  algorithm,  the  Command  Interpretation  algorithm  (Cl)  receives 
and  interprets  possible  commands  (v')  from  other  mles,  which  restrict  the  set  of  responses  that  can 
be  generated.  The  Cl  stage  outputs  a  command  v  which  is  used  in  the  Response  Selection  algo¬ 
rithm  (RS)  to  produce  the  response  of  the  role,  the  output  y.  This  output  can  be  sent  to  the  effec¬ 
tors  and/or  to  other  roles  in  the  system.  The  input  stage  of  a  role  may  be  SA,  IF  or  Cl;  all  stages 
that  accept  external  inputs.  The  final  output  stage,  however,  must  be  RS,  the  stage  at  which  the 
role  selects  its  response. 


S.A  IF  CI  RS 


Fig.  3  Four  Stage  Model 

Ever\’  component  of  the  system  might  not  have  access  to  all  the  sensors'  observations.  It 
might  base  its  processing  on  a  restricted  number  of  observations.  In  the  submarine,  the  communi¬ 
cation  of  the  observations  from  the  two  sensors  are  modeled  as  shown  Fig.  4,  where  5,^  ,  for  i  = 
1.2.  j  =  1 ,  2,  3,  models  the  communication  of  the  output  of  i-th  sensor  to  the  SA  stage  of  Role  j. 
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Fig.  4  Interactions  Roles-Sensors 

Only  certain  types  of  interactions  make  sense  within  the  model  (Remy  and  Levis,  1988).  They 
are  depicted  on  Fig.  5.  For  the  sake  of  clarity,  only  the  links  from  the  i-th  role  to  the  j-th  role  have 
been  represented.  The  symmetrical  links  from  i  to  ;  are  valid  interactions  as  well. 


SA  IP  Cl  RS  Role* 


Fig.  5  Allowable  Interactions  between  two  Roles 

The  parameter  5,  models  the  case  in  which  the  i-th  role  communicates  the  response  it  has  se¬ 
lected  to  the  external  environment  through  the  effectors.  If  Role  i  sends  its  response  to  the  effec¬ 
tors,  then  there  exists  a  link  between  the  RS  stage  of  Role  i  and  the  output  transition.  This  output 
transition  has  a  unique  output  place,  which  is  called  the  sink.  is  the  interaction  that  occurs  when 
the  situation  assessment  which  is  produced  as  an  output  of  the  SA  stage  is  sent  to  the  j-th  role  to  be 
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fused  with  the  assessment  of  the  j-th  role,  and/or  assessments  from  other  roles.  G^j  depicts  the 
case  where  the  response  selected  by  the  i-th  role  is  the  input  of  the  j-th  role.  H^j  shows  the  sharing 
of  a  result.  The  i-th  role  informs  the  j-th  role  of  its  final  decision.  The  j-th  role  may  or  may  not  take 
this  information  into  account.  Finally,  C^-  has  been  introduced  to  model  hierarchies  between 
roles.  It  describes  the  possibility  of  role  i  sending  a  command  to  role  j. 

A  variable  structure  for  the  submarine  system  is  completely  determined  by  the  six-tuple 


n  =  (S,  s,  F,  G,  H,  C)  . 

•  S  is  a  2  X  3  block  array. 

•  s  is  a  1  X  2  block  array. 

•  F.  G,  H,  C  are  four  3x3  block  arrays. 

F-  models  the  link  from  the  S  A  stage  of  Role  i  to  the  IF  stage  of  Role  j. 

G, j  models  the  link  from  the  RS  stage  of  Role  i  to  the  SA  stage  of  Role  j. 

H, j  models  the  link  from  the  RS  stage  of  Role  i  to  the  IF  stage  of  Role  j. 

Cjj  models  the  link  from  the  RS  stage  of  Role  i  to  the  Cl  stage  of  Role  j. 

•  Everv'  block  in  0  =  (S,  s,  F,  G,  H,  C)  is  a  9  x  9  diagonal  matrix  L. 

L,,  =  1  11  ,  .-th  input  in  the  lexicographic  ordering  aedvates  the  link. 

Ljj  =  0  if  the  i-th  input  in  the  lexicographic  ordering  does  not  activate  the  link. 


The  set  of  all  variable  structures  is  called  V.  Similarly,  a  fixed  variable  structure  can  be  repre¬ 
sented  as  a  six-tuple 


1=  (S',  s’,  F,  G’-  H',  C  ) 


•  S'  is  an  2  X  3  array 

•  s'  is  a  1  X  2  array, 

•  F,  G',  H',  C  '  are  four  3x3  arrays. 

Their  entries  are  in  {0,  1 }:  1  if  the  interaction  is  present;  0  if  the  interaction  is  not  present. 

The  set  of  fixed  structures  is  called  VV.  The  results  of  the  methodology  are  based  on  the  fol¬ 
lowing  propenies  of  the  sets  V  and  W. 

Property  1 :  Each  element  of  V  can  be  equivalently  described  in  matrix  form  by  0  or  by  a  Colored 
Petri  .Net. 
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There  exists  a  one  to  one  relationship  between  the  representation  of  a  variable  structure  in  a  matrix 
form  and  a  Colored  Petri  Net  model  of  the  structure.  One  can  thus  work  with  the  language  that  is 
most  appropriate  for  one's  needs. 

Property  2:  Each  element  of  W  can  be  equivalently  described  in  matrix  form  by  Z  or  by  an 
Ordinary  Petri  Net. 

There  exists  a  one  to  one  relationship  between  the  representation  of  a  fixed  structure  in  a  matrix 
form  and  an  Ordinary  Petri  Net  model  of  the  structure. 

Property  3:  Any  variable  structure  corresponds  to  a  mapping 

ri;  x->w 

X  ->  n(x), 

which  associates  with  each  input  in  X  one  and  only  one  fixed  structure. 

These  propenies  relate  the  results  that  have  been  developed  for  fixed  structure  systems  to 
propenies  of  variable  structure  systems.  Finally,  some  relations  that  ease  the  investigation  of  the 
set  of  variable  structures,  V,  and  the  set  of  fixed  structures,  W,  must  be  introduced.  These  relations 
are  partial  orderings  that  allows  one  to  sort  the  elements  of  V  and  W. 

•  The  set  V  of  variable  structures  is  ordered  by  the  binary  relation  ACT,  where 

n  ACT  IT 

is  equivalent  to  the  statement  that  every  input  that  activates  an  interaction  in  0  activates 
the  same  interaction  in  O',  i  .e.,  H  has  fewer  than  or  equal  number  of  interactions  as  IT  • 

The  elements  of  V  can  be  ordered  using  ACT  from  the  ones  with  the  least  activation  to  the 
ones  with  the  most  activation. 

•  The  set  W  is  ordered  by  the  binary  relation  SUB,  w'here 

I  SUB  I' 

means  that  every  interaction  in  S  is  present  in  i.e.,  the  Ordinary  Petri  Net  that  rep¬ 
resents  Z  is  a  subnet  of  the  Ordinary  Petri  Net  that  represents  Z' . 

The  elements  of  W  can  be  ordered  using  SU^  from  the  least  connected  ones  to  the  maximal¬ 
ly  connected  ones. 


DESIGN  REQUIREMENTS 

The  requirements  for  the  C^  system  can  be  translated  into  requirements  on  the  matrix  forms  of 
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the  structures.  The  designer  may  rule  in  or  rule  out  some  links,  or  force  the  variability  of  some 
other  links.  If  a  link  must  be  ruled  in,  the  9  x  9  Identity  matrix  I  must  be  put  in  the  appropriate 

entry  of  0-  If  a  link  has  to  be  ruled  out,  the  designer  must  put  the  9x9  null  matrix  in  the  appropri¬ 
ate  entry  of  0.  Finally,  a  variable  link  can  be  defined  by  putting  a  matrix  L  that  describes  the  vari¬ 
able  interaction  in  the  appropriate  entry  of  O-  At  the  end  of  the  specifications,  some  links  may  re¬ 
main  unspecified,  and  constitute  the  degrees  of  freedom  of  the  design.  An  unspecified  link  is  anno¬ 
tated  by  the  symbol  "#". 

The  first  constraint  on  the  design  is  that  OOD  does  not  monitor  the  sonar.  Because  of  the  hier¬ 
archical  relationships,  it  is  assumed  that  ASW  cannot  issue  a  command  to  ASUW,  and  conversely 
that  .^SUW  cannot  issue  a  command  to  ASW.  It  is  further  assumed  that  the  design  should  recog¬ 
nize  structures  that  optimize  the  existing  expertise  in  the  system.  For  that  purpose,  ASW  should  be 
the  role  that  fomiulates  the  tactical  response  if  the  submarine  is  only  threatened  in  the  deep  sea  en- 
\  ironment.  Similarly,  if  a  threat  is  detected  in  the  surface  environment  only,  the  ASUW  should  be 
the  role  that  issues  commands  to  the  effectors.  Finally,  if  no  threat  has  been  detected,  or  if  threats 
are  detected  in  both  environments,  the  OOD  should  formulate  the  tactics  to  be  followed.  These  con¬ 
straints  yield: 

•  The  Constraints  on  S  are  given  by: 

A.s\v  OOD  .ASr’ 

^  _  I  0  O]  Sensor  1 

,0  0  Ij  Sensor  2 

The  matrix  S  is  completely  specified.  S  indicates  that  the  output  of  Sensor  1,  the  state  of  the 
deep  sea  environment,  can  only  be  monitored  by  ASW,  and  that  the  output  of  Sensor  2,  the 
state  of  the  surface  environment,  can  only  be  accessed  by  ASUW. 

•  The  constraints  on  s  are  determined  by  the  fact  that  the  objective  of  the  design  is  to  obtain 
wunable  structures  that  recognize  the  expertise  of  the  different  roles.  Thus  ASW  must  select  a 
response  to  be  sent  to  the  effectors  if  and  only  if  the  inputs  to  the  system  are  <S,  NSU>, 
<T,  XSU>.  These  inputs  describe  the  situations  in  which  there  is  only  a  submarine  threat. 

•  ASUW'  must  select  a  response  to  be  sent  if  and  only  if  the  inputs  to  the  system  are  <NS,  dC>, 
<NS,  SU>.  These  inputs  describe  the  situations  in  which  there  is  only  a  surface  threat. 

•  OOD  must  select  the  response  in  all  other  cases,  which  are  v:NS,  NSU>,  <S,  dC>. 
<S,  SU>,  <T,  dC>,  <T,  SU>.  These  inputs  describe  the  situations  in  which  there 
are  either  no  threats,  or  threats  in  both  the  submarine  and  the  surface  environments. 

ASW  OOD  ASLAA' 

S  =  [L1,  L3,  L2] 
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<NS,dC>  <NS.NSU>  <NS.  SU>  <S.dC>  <S.  NSU  >  <S,  SU  >  <T.  dC>  <T.  NSU  ><^T.  SU  > 
Ll=diag[  0,  0,  0,  0,  1,  0,  0,  1,  0  ]. 

<NS.dC>  <NS,NSU>  <NS.su  >  <S,dC>  <S.NSU><S,SU><T,dC>  <T.  NSU  >  <T.  SU  > 

L2  =  diagl  1,  0,  1,  0.  0,  0,  0,  0,  0  ]. 

<NS.dC>  <NS,NSU>  <NS,  SU>  <S.dC>  <S.NSU><S.SU>  <T.dC>  <T,  NSU  >  <T,  SU  > 

L3  =  diag[  0,  1,  0,  1,  0,  1,  1,  0,  1  ]. 

•  Constraints  related  to  F:  Both  ASW  and  ASUW  must  inform  the  OOD  of  their  situation  as¬ 
sessment.  The  role  OOD  does  not  receive  information  at  its  SA  stage,  therefore  it  cannot  send 
any  situation  assessment.  No  other  constraints  have  been  stated  on  the  sharing  of  information. 
Thus  F  is 

ASW  OOD  ASUW 

0  I  #1  ASW 
F=  0  0  0  003 
.#  I  oj  ASUW 

•  Constraints  on  G;  In  this  example,  the  input  of  one  role  must  be  either  the  observation  from  a 
sonar  (ASW  and  ASUW)  or  a  situation  assessment  (OOD),  thus 

'O  0  o' 

G=  0  0  0 
.0  0  0. 

•  Constraints  on  H;  No  constraint  has  been  expressed  on  the  sharing  of  responses 

'o  #  #' 

H=  #  0  # 

.#  #  0. 

•  Constraints  on  C:  The  constraint  on  the  hierarchical  structure  is  that  both  ASW  and 
ASUW  cannot  issue  commands  or  advisories  regarding  the  tactical  response  to  each  other. 
However,  they  can  issue  advisories  to  OOD,  or  can  receive  commands  or  advisories  from  it. 

ASW  OD  ASUW 

0  #  ol  ASW 
c=  #  0  #  OD 
.0  #  oJ  ASUW 

The  requirements  are  translated  into  requirements  on  the  CPN  model  of  the  variable  structures 
on  Fig.  6.  To  ease  the  readability  of  the  net,  a  link  that  has  been  ruled  out  has  not  been  represented, 
a  link  that  is  permanent  is  drawn  with  a  bold  line  without  annotations,  and  a  link  whose  variability 
is  imposed  has  been  drawn  in  a  bold  line  and  annotated  by  the  appropriate  matrix. 
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Fig.  6  Colored  Petri  Net  model  of  Design  Requirements. 

CONSTRAINTS 

There  :ire  many  degrees  of  freedom  and,  consequently,  the  set  of  variable  structure  systems 
which  fulfill  the  designer's  constraints  is  quite  large.  However,  all  the  variable  structures  that  be¬ 
long  to  this  set  might  not  be  solutions  that  make  physical  sense.  Some  structural  constraints  must 
be  defined  to  restrict  the  class  of  solutions  to  those  that  are  acceptable.  The  structural  constraints  on 
V  can  be  divided  into  tw-o  classes.  The  class  of  constraints  relates  the  propenies  of  variable  struc¬ 
tures  to  the  properties  of  fixed  structures,  as  described  in  Remy  (1988).  The  second  class  of  con¬ 
straints  is  specific  to  variable  structures  (Demael,  1989). 

Let  n  be  a  variable  structure.  For  any  x  in  X,  the  fixed  structure  FKx)  must  satisfy: 

•  (Rl)  (a)  The  Ordinary  Petri  Net  that  corresponds  to  TKx)  should  be  connected,  i.e.,  there 
should  be  at  least  one  (undirected)  path  between  any  two  nodes  in  the  Net  (b)  A  directed  path 
should  exist  from  e  external  place  to  every  node  of  the  PN  and  from  every  node  to  the  sink. 

•  (R2)  The  Ordi'- a:;  Petri  Net  that  corresponds  to  IKx)  should  have  no  loops,  i.e.,  the  struc¬ 
ture  must  be  ac} 

•  (R3)  In  the  Ordina*-  tri  Net  that  corresponds  to  FICx),  there  can  be  at  most  one  link  from 
the  RS  stage  *.  f  a  role  i  to  another  role  j,  i.e.,  for  each  i  and  j,  only  one  element  of  the  triplet 
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{G(x)y,  H  (x)  jj,  C  (x)jj}  can  be  non-zero. 

•  (R4)  Information  fusion  can  take  place  only  at  the  IF  and  Cl  stages.  Consequently,  the  SA 
stage  of  a  role  can  either  receive  observations  from  sensors,  or  receive  one  and  only  one  re¬ 
sponse  sent  by  some  other  role. 

•  (R5)  There  cannot  be  one  link  from  the  SA  stage  of  role  i  to  the  IF  stage  of  role  j  and  a  link 
from  the  RS  stage  of  role  i  to  the  SA  stage  of  role  j. 

Constraint  Rl(a)  eliminates  a  data  flow  structure  that  does  not  represent  a  single  stmcture. 
Constraint  Rl(b)  insures  that  the  flow  of  information  is  continuous  within  the  organization,  that 
there  are  no  other  sources  of  information  than  Sensors  1  and  2.  Constraint  R2  allows  acyclical 
fixed  dataflow  structures  only.  This  restriction  is  imposed  to  avoid  deadlocks  and  infinite  circula¬ 
tion  of  messages  wathin  the  organization.  Constraint  R3  indicates  that  it  does  not  make  sense  to 
send  the  same  output  to  the  same  role  at  several  stages.  It  is  assumed  that  once  the  output  has  been 
received  by  a  role,  this  output  is  stored  in  its  internal  memory  and  can  be  accessed  at  later  stages. 
Constraints  R4  and  R5  ensures  that  the  IF  stage  is  indeed  a  stage  at  which  items  of  information 
coming  from  different  sources  are  fused. 

•  ( R6)  If  the  first  stage  of  a  role  is  S  A,  then  each  input  link  in  S  and  G  is  permanent 

’  (R7)  If  ..  first  stage  of  a  role  i  is  IF,  then  each  input  link  Fjj,  Hjj  for  j  in  [1..R]  is  perma 

nent. 

•  (R8)  If  the  first  stage  of  a  role  i  is  Cl,  then  each  input  link  C^j  for  j  in  [1..R]  is  permanent 

•  {R9)  Let  L  be  a  variable  link  between  two  stages  tl  and  t2,  and  let  us  suppose  that  Xi  is  an 

effective  alphabet  of  the  variable  interaction.  If  tl  is  a  SA  stage  and  t2  is  a  IF  stage,  then  Xi 
must  be  accessible  at  tl  and  at  the  SA  stage  of  the  role  that  contains  t2.  If  tl  is  a  RS  stage  and 
t2  is  a  IF  stage,  then  Xi  must  be  accessible  at  t  and  at  the  SA  stage  of  the  role  that  contains  t2. 
If  tl  is  a  RS  stage  and  t2  is  Cl  stage,  then  Xi  must  be  accessible  at  tl  and  at  the  IF  stage  of  the 
role  that  contains  t2. 

Constraints  R6,  R7,  and  R8  proceed  from  a  common  rationale.  They  state  that  a  role  at  its 
input  stage  does  not  have  any  knowledge  about  the  input  to  the  system,  and  cannot  exhibit  a  vari¬ 
able  interaction.  Thus,  at  the  SA  stage,  any  link  between  the  sensors  and  the  roles  must  be  fixed. 
Similarly,  if  a  role  receives  the  response  from  another  role,  the  latter  must  always  communicate  its 
response  (R6).  Constraints  R7  and  R8  incorporate  the  fact  that  the  input  stage  of  a  role  can  be  the 
Information  Fusion  or  Command  Interpretation  stages.  Constraint  R9  states  that  a  variable  interac¬ 
tion  between  two  stages  tl  and  t2  must  be  based  on  sources  of  information  that  are  accessed  jointly 
by  the  roles  that  interact.  The  stage  tl  must  determine,  based  on  some  information  it  has  accessed, 
whether  or  not  it  has  to  send  a  message  to  t2.  Similarly,  the  role  that  contains  t2  must  infer  from 
some  of  the  information  it  has  already  received,  whether  or  not  it  must  wait  for  a  message  from  tl 
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before  initiating  process  t2.  Observe  that  the  role  containing  t2  has  received  this  information  at  the 
internal  stage  preceding  t2. 


COMPUTATION  OF  SOLUTIONS 

The  characterization  of  the  set  of  solutions  to  the  design  problem  is  closely  related  to  the  deter¬ 
mination  of  the  maximal  and  the  minimal  solutions.  A  solution  Ho  is  minimal  in  V  if  it  is  not  pos¬ 
sible  to  have  a  variable  structure  11,  with  FT  ACT  Ho,  without  violating  one  of  the  constraints  R1 
to  R9.  A  solution  is  maximal  in  V  if  it  is  not  possible  to  have  a  variable  structure  0,  with  11° 
ACT  n,  without  violating  one  of  the  constraints  Rl  to  R9.  Minimal  and  maximal  solutions  in  W 
are  defined  in  a  similar  manner. 

The  computation  of  the  minimal  and  maximal  solution  in  V  proceeds  as  follows.  First,  an 
analysis  of  the  constraints  of  the  designer's  requirements  is  performed  so  as  to  determine  the  num¬ 
ber  of  different  tactical  situations  relevant  to  the  problem.  Each  tactical  situation  is  then  assigned  to 
one  and  only  one  fixed  pattern  of  interaction  between  OOD,  ASW,  ASUW.  Three  tactical  situa¬ 
tions  are  present  in  the  submarine  example. 

•  The  first  tactical  situation  happens  if  there  is  a  threat  in  the  submarine  environment  only,  i.e., 
when  the  inpu'  to  the  system  belongs  to  EXi=  {<S,  NSU>,  <T,  NSU>}.  ASW  1  simulates 
the  tactical  response  in  that  case.  Each  input  in  EXj  must  be  processed  according  to  the  same 

fixed  structure  If  The  constraints  on  I^  are  that  I^  must  contain  a  fixed  link  from  the  RS 
stage  of  ASW  to  the  effectors,  and  that  there  shall  not  be  fixed  links  from  the  RS  stages  of 
OOD  and  ASUW  to  the  effectors.  Let  W'  be  the  set  of  fixed  structures  that  verify  these  con¬ 
straints. 

•  The  second  tactical  situation  corresponds  to  a  threat  in  the  surface  environment  only,  i.e., 
when  the  input  to  the  system  belongs  to  EX2  =  {<NS,  dC>,  <NS,  SU>}.  ASUW  formulates 
the  tactical  response  in  that  case.  Each  input  in  EXj  must  be  processed  according  to  the  same 

fixed  structure  I^.  The  constraints  on  I^  are  that  I^  must  contain  a  fixed  link  from  the  RS 
stage  of  ASUW  to  the  effectors,  and  that  there  shall  not  be  fixed  links  from  the  RS  stages  of 
OOD  and  ASW  to  the  effectors.  Let  W^  be  the  set  of  fixed  structures  that  verify  these  con¬ 
straints. 

•  The  third  tactical  situation  corresponds  to  the  case  in  which  OOD  has  to  formulate  the  tac¬ 
tical  response,  i.e.,  when  the  input  belongs  to  EX={<NS,NSU>,  <S,dC>,<S,  SU>,<T, 
dC>,  <T,  SU>}.  Each  input  in  EX3  must  be  processed  according  to  the  same  fixed  structure 

I^.  The  constraints  on  I^  are  that  must  contain  a  fixed  link  from  the  RS  stage  of  OOD  to 
the  effectors,  and  that  there  shall  not  be  fixed  links  from  the  RS  stages  of  ASUW  and  ASW  to 
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the  effectors.  Let  be  the  set  of  fixed  structures  that  verify  these  constraints. 

Then,  maximal  and  minimal  candidate  solutions  are  computed  based  on  the  properties  exposed 
hereafter.  A  candidate  solution  is  a  variable  structure  that  satisfies  all  constraints  of  the  design  but 
R9,  which  must  be  checked  independently. 

Property  4:  Consider  the  fixed  structure  of  Fig.  7,  called  the  Universal  Net,  which  contains  all 
the  interactions  that  have  not  been  ruled  out  at  the  design  specifications  stage.  Then, 

Z-  must  be  subnets  of  the  Universal  Net. 

ZL  Z^,  Z^  are  characterized  by  simple  information  flow  paths.  A  simple  information  flow 
path  is  a  directed  path  without  loops  from  the  external  place  of  the  Universal  Net  to  the  sink. 

Proposition  5:  Z  is  a  fixed  structure  in  W‘,  i  =  1,  2,  or  3,  if  and  only  if  Z  lies  between  a  maxi¬ 
mal  solution  and  a  minimal  solution  in  W': 

3ZiandZ2  such  that  Zj  SUB  Z  SUB  Z2 

Z  is  a  union  of  simple  information  flow  paths  of  ZU,  the  Universal  Net. 

Finally,  a  candidate  solution  to  the  design  verifies  Proposition  6. 

Proposition  6:  A  variable  structure  verifies  all  constraints  of  the  design  in  the  submarine  example 
but  R9  if  and  only  if  fl  lies  between  a  maximal  candidate  solution  and  a  minimal  candidate  solution: 

3  n,  and  132  that  flj  ACT  13  ACT  132 

rii  is  such  that 

EXj  ->Z^  with  Z^  minimal  solution  in  W> 

EX2  ->  Z^,  with  Z^  minimal  solution  in 
EX3  ->  Z^,  with  Z^  minimal  solution  in 

H:  is  such  that 

EXj  — >Z^withZ*  maximal  solution  in  W' 

EX2  ->  Z^,  with  iP-  maximal  solution  in 
EX3  ->  Z^,  with  Z^  maximal  solution  in 
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Candidate  maximal  and  minimal  solutions  are  computed  using  the  Lattice  algorithm  (Remy, 
1988).  This  algorithm  determines  the  minimal  and  maximal  solutions  in  W',  W^,  and  W^.  Then, 
using  the  characterization  of  a  variable  structure  as  a  mapping  from  X  into  V,  the  minimal  map¬ 
pings  FTi  and  the  maximal  mappings  112  can  be  translated  into  Colored  Petri  Nets.  The  output  of 
the  computation  in  the  submarine  case  yields  512  candidate  minimal  solutions  and  512  candidate 
maximal  solutions. 

Unfonunately,  all  variable  structures  between  minimal  candidate  solutions  and  maximal  candi¬ 
date  solutions  do  not  fulfill  constraint  R9.  The  reason  is  that  many  variable  structures  between  the 
candidate  maximal  and  the  minimal  solutions  exhibit  variable  links  in  which  the  effective  alphabets 
are  not  accessible.  However,  the  set  of  solutions  can  be  completely  determined  once  minimal  and 
maximal  solutions  are  computed.  The  last  step  of  the  computation  takes  as  input  candidate  minimal 
and  maximal  solutions,  and  checks  constraint  R9  to  find  minimal  and  maximal  solutions.  R9  is 
checked  1)  by  determining  for  each  variable  link  its  effective  alphabets;  2)  If  Xi  i  =  1  or  2  is  an  ef¬ 
fective  alphabet,  by  checking  if  each  fixed  structure  and  L'  contains  a  simple  information 

flow  path  which  includes  the  link  and  the  place  Source  i  (Xi  is  effective).  If  one  variable  link  does 
not  fulfill  R9,  the  structure  is  rejected. 

Minimal  solutions  are  computed  by  checking  first  all  the  candidate  minimal  solutions.  If  some 
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candidate  minimal  solutions  verify  R9,  then  the  computation  stops.  Otherwise,  the  search  contin¬ 
ues  inductively  on  the  variable  structures  that  are  immediately  above,  until  a  solution  is  found. 
Symmetrically,  the  maximal  solutions  are  computed  by  scanning  first  all  the  candidate  maximal  so¬ 
lutions.  If  some  such  structures  fulfill  R9,  the  search  is  stops.  Otherwise,  it  continues  inductively 
by  checking  the  set  of  candidate  solutions  that  are  immediately  below  the  ones  just  scanned. 

It  turns  out  that  there  is  one  one  and  only  one  solution  in  the  submarine  example.  This  exam¬ 
ple  shows  therefore  that  constraint  R9  can  be  quite  stringent,  and  restricts  dramatically  the  number 
of  solutions  to  the  design  problem,  as  compared  to  the  size  of  the  set  of  variable  structures  that  sat¬ 
isfy  all  constraints  but  R9.  One  feels  immediately  that  this  reduction  in  size  can  have  both  positive 
and  negative  effects.  On  one  hand,  this  reduction  facilitates  the  computational  problem  and  any  im¬ 
plementation  of  the  methodology.  Another  positive  effect  is  that  it  may  provide  the  designer  with  a 
small  set  of  solutions,  which  may  be  analyzed  more  thoroughly  than  if  the  set  of  solutions  were 
large.  On  the  other  hand,  this  reduction  in  size  may  interfere  with  the  probability  that  a  solution  ex¬ 
ists.  because  the  more  drastic  the  reduction,  the  less  likely  the  existence  of  a  solution.  Finally,  note 
that  it  is  unlikely  that  this  reduction  in  size  is  just  an  artifact  of  the  model;  there  are  many  practical 
and  theoretical  reasons  to  believe  that  coordinating  the  activity  of  distributed  entities  is  very  diffi¬ 
cult.  A  CPN  model  of  the  solution  is  depicted  in  Fig.  8,  which  corresponds  to  a  mapping: 

EXl  with  I*  represented  in  Fig.  9 
EX2">I^,  with  I'“  depicted  on  Fig.  10 
EX3  ">  S^,  with  shown  on  Fig.  12. 

I'  represents  the  exchange  of  information  between  roles  when  there  is  a  threat  in  the  subma¬ 
rine  environment  only.  In  this  pattern  of  interaction,  the  situation  assessments  of  ASW  and  ASUW 
are  sent  to  every  role  in  the  system.  ASUW  chooses  a  response  which  is  communicated  to  (X)D. 
OOD  incoiporates  the  situation  assessments  of  ASW  and  ASUW  to  the  response  selected  by 
ASUAV,  and  selects  a  command  to  be  sent  to  ASW.  Finally,  ASW  interprets  this  command  and 
chooses  an  appropriate  course  of  action,  which  is  communicated  to  the  effectors. 

represents  the  case  of  a  surface  threat.  The  interactions  are  symmetrical  to  those  in  Zk  The 
situation  assessments  are  sent  to. every  role  in  the  system.  ASW  communicates  its  response  to 
OOD.  OOD  incorporates  the  situation  assessments  and  the  response  of  ASW  so  as  to  select  a  com¬ 
mand  to  be  sent  to  ASUW.  Finally,  ASUW  interprets  this  command  and  chooses  an  appropriate 
course  of  action  which  is  communicated  to  the  effectors. 
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Fig.  8  Solution  to  the  Design  Problem 


OI 


Fig.  9  Fixed  Structure 
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Fig.  10  Fixed  Structure 

Finally,  if  the  tactical  response  is  formulated  by  the  Officer  of  the  Deck,  the  exchange  of  infor¬ 
mation  between  the  roles  is  depicted  by  OOD  receives  the  situation  assessments  of  ASW  and 

ASUW,  waits  for  their  expert  responses,  and  interprets  their  expert  advisories  with  his  assessment 
of  the  mission,  so  as  to  produce  the  response  to  be  communicated  to  the  effectors. 

It  must  be  noted  that  the  variable  structure  is  fairly  simple  and  robust.  Each  expert  subordinate 
has  two  modes  of  interactions  overall.  Each  role  always  communicates  its  situation  assessment  to 
the  other  expert  subordinate  and  OOD.  Eveiy  expert  expects  to  receive  the  situation  assessment  of 
the  other  role,  irrespective  of  the  tactical  parameters.  Then,  if  an  expert  role  has  to  formulate  the  re¬ 
sponse,  it  waits  for  a  command  from  OOD.  Otherwise,  it  sends  its  expert  advisory  to  the  Officer  of 
the  Deck.  Similarly,  OOD  receives  the  situation  assessments  of  both  subordinates,  and  infers  from 
them  the  state  of  the  environment.  Then,  if  OOD  has  to  formulate  the  tactical  response,  he  waits  for 
the  expen  responses.  Otherwise,  he  integrates  the  response  from  the  expert  who  has  not  detected  a 
threat  with  its  own  assessment,  and  issues  a  command  to  the  subordinate  who  issues  the  tactical  re¬ 
sponse. 
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CONCLUSION 

In  this  paper  a  quantitative  methodology  for  modeling  variable  structures  and  for  solving  their 
coordination  problem  is  presented.  The  class  of  systems  considered  process  deterministically  a  set 
of  simultaneous  observations.  This  methodology  models  variable  structures  with  Colored  Petri 
Nets,  which  are  used  as  the  basic  mathematical  framework  to  generate  the  set  of  structures  that  sat¬ 
isfy  design  requirements.  The  designer  of  a  system  can  describe  his  degree  of  knowledge  about  the 
requirements  in  a  matrix  form  that  is  translated  into  the  language  of  Colored  Petri  Nets.  Then,  an 
algorithm  determines  the  set  of  variable  structures  that  satisfy  the  designer's  requirements  as  well 
as  some  generic  constraints.  This  methodology  provides  a  basic  step  towards  the  modeling  and 
analysis  of  more  realistic  C^  systems. 
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